exports.authorize = function(req, res, next) {
    // 校验用户是否登录
    if (req.session === undefined || req.session.user === undefined || req.session.role === undefined || global.users[req.session.user.id] === undefined) {
        // res.redirect("");
        if (req.route.path.endsWith(".v")) {
            res.redirect(global.contextPath + "/login.html");
        }
        else {
            res.json({"success": false, "message": "未登录或登录超时！"});
        }
        return;
    }

    if (req.sessionID !== global.users[req.session.user.id]) {
        req.session.user = null;
        req.session.role = null;
        req.session.destroy();
        res.clearCookie("user");
        res.clearCookie("userId");
        res.clearCookie("sessionId");
        res.clearCookie(global.cookieIndentity);
        delete req.session;
        if (req.route.path.endsWith(".v")) {
            res.redirect("/login.html");
        }
        else {
            res.json({"success": false, "message": "您的账号在另一地点登录，已被迫下线！"});
        }
        return;
    }
    let role = req.session.role;
    let path = (req.baseUrl + req.route.path).replace(global.contextPath + '/rest', '').replace(global.contextPath, '');
    let restPath = ',' + req.method + path + ',';

    if (role.roles.indexOf(restPath) === -1) {
        res.json({"success": false, "message": "无权限访问当前功能！"});
        return;
    }

    next();
};